ci(uv): use uv sync --frozen everywhere

[noirbizarre]

Description

• use uv sync --frozen everywhere to keep control over the lock file
• move poethepoet into a separate base group to be able to install it in CI without all the dev dependencies
• use uv run --no-sync in CI and pre-commit to avoid lock update

Checklist

• I have read the contributing guidelines

Code Changes

None

Documentation Changes

Update contribution guides to use uv sync --dev --frozen

Expected Behavior

• no unsolicited lock update
• reproducible builds
• no failure as soon as uv update it's lock format

Steps to Test This Pull Request

CI should just run without lock update

Additional Context

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.88%. Comparing base (095913a) to head (29ae475).
⚠️ Report is 3 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1764   +/-   ##
=======================================
  Coverage   97.88%   97.88%           
=======================================
  Files          60       60           
  Lines        2606     2606           
=======================================
  Hits         2551     2551           
  Misses         55       55           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.